2,304 reputation
11019
bio website
location
age
visits member for 2 years, 10 months
seen yesterday

Aug
8
comment Secure Session Cookies
I think you are confusing "Non-repudiation" and integrity.
Aug
8
comment Secure Session Cookies
@symcbean "Browsers vary in whether they manage cookies in a central store" which browsers do not behave as if they used a central cookie store? (Using "private mode" and multiple "profiles" do not count, any functionality intended to change your online identity and session state do not count.)
Aug
8
comment Is a cookie safer than a simple HTTP header?
@Joshua "If an attacker injects an image, javascript" If the attacker can inject JS, then he just controls the webpage. He does not need the capture a Referer. He can read (even capturing form data) and modify any part of the page (displaying incorrect information to the user, or changing form data just before submission), and retrieve any cookie not marked HTTPOnly, and do anything on behalf of the user.
Aug
8
comment Is a cookie safer than a simple HTTP header?
"Safe" is a meaningless term, just as "secure". You have to define a context: who is your adversary? Do you consider the possibility of wiretapping? Do you consider a website with user supplied contain, like this very website?
Aug
8
comment Is a cookie safer than a simple HTTP header?
@lynks The Referer contains the whole URL as sent to the HTTP server. It does not contain the local part after the #.
Aug
8
comment Is a cookie safer than a simple HTTP header?
1: You (the webmaster) control the outbound links. If you can manage to have only links to sites under your control, 1. is not a problem. 2: Who implements Cookie2?
Aug
8
comment wpa2-psk + wireless isolation = secure connection?
It there a standard definition of "isolation"?
Jul
14
awarded  Nice Answer
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
@Adnan "Really?" No, not really.
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
@LucasKauffman -1; SFTP is a part of SSHv2.
Jul
9
comment How is HTTP PUT and DELETE methods insecure, if they really are?
"or even GET /users/1/delete." be careful with GET which is supposed to not have side effects.
May
28
revised Why are passwords limited to 16 characters?
tiny edits: some rephrasing, correcting one typo
May
22
awarded  Taxonomist
May
15
comment Are CSRF Attacks Really Blind
What should parse as CSS (according to std), exactly? I have really no idea. What does parse as CSS, in real world browsers? What might parse in the future? I am not sure. I am just unsure, and it is unpleasant. The mere fact that I might have to worry about a potential, unlikely, problem is annoying. I like to be able to make security proofs not rely on how unlikely it is that something sensitive might parse as CSS, someday.
May
15
comment Are CSRF Attacks Really Blind
"stylesheet, but can't programatically access its contents" Can't you get the "computed" style of your own page elements? That would tell you something about the included CSS.
Apr
8
awarded  Nice Answer
Apr
1
comment Does “loose source and record route” drop the source address?
+1 for mentioning using loose source routing for stateless "NAT"
Mar
29
comment Security issues with allowing Dropbox installations on client PC's in our organisation
"Payment Card Industry (PCI) Standards says so" why would you even want to handle Payment Card data? That is the job of banks and other specialized payment operators! IMO most company should not even think about handling these sensible information themselves. If they do, it should be on isolated computers, such that file sharing software can be installed on other computers without any risk for payment data.
Mar
29
revised Does “loose source and record route” drop the source address?
edited tags
Mar
29
revised How do browsers know which cookie to get?
edited tags